attempt to crack the ecu....
Thread Starter
Junior Member
Joined: Jul 2004
Posts: 23
Likes: 0
From: Brookfield CT
attempt to crack the ecu....
Ive been doing low level computer programming for years, and ive decided to attempt decode the ecu code to psuedo-c style instructions so tuners can easily reprogram the stock ecu, or create a more reliable after-market ecu code, i just need a few things to start it... any help will be great im researching it now-
1. the original binary/hex code stored on the ecu
2. info on the processor or chipset in the ecu preferibly. If not then just the manufacturer of the ecu its self(3rd party.... hopefully it just doesnt say mazda).
Once i can find the opcodes/instruction format of the specific processor / generic info on the on board memory storage i can decode it and supply users with atleast the hex code commented with psuedo-c style instructions along with simple tuner tricks on the input/output voltages of each wire and how it effects the ecus output of other wires by a ugly flow chart. Any help would be great. thanks, wish me luck
1. the original binary/hex code stored on the ecu
2. info on the processor or chipset in the ecu preferibly. If not then just the manufacturer of the ecu its self(3rd party.... hopefully it just doesnt say mazda).
Once i can find the opcodes/instruction format of the specific processor / generic info on the on board memory storage i can decode it and supply users with atleast the hex code commented with psuedo-c style instructions along with simple tuner tricks on the input/output voltages of each wire and how it effects the ecus output of other wires by a ugly flow chart. Any help would be great. thanks, wish me luck
Good luck to you, sounds like a fun way to learn a bit more about electronics. However, it's still going to be an 8-bit ECU, the fuel and timing maps aren't nearly as high of a resolution as a 16-bit ECU. If you're trying to improve the performance of your car, or create a marketable product, the 8-bit ECU is not the path to be pursuing, IMHO.
-s-
-s-
Joined: Jul 2003
Posts: 4,678
Likes: 96
From: Bay Area, CA
The most informative post in that link is as follows:
In other words, even if you could figure out how controller code works (which would be very difficult even if you had a full spec for the controller's machine language - which may be impossible to get - and could decode the code that is there now), it would not necessarily make much sense to rewrite it. Knowing the memory locations of the maps would be sufficient.
If you did want to develop a fully reprogrammable ECU, it would be probably be easier to start from scratch with more modern chips (can you say Power FC?). This would probably be 5-10 man-years of work to do properly and would require significant hardware resources (as in several 13Bs that you might blow and lots of expensive monitoring equipment), would require an incredibly deep knowledge of modern engine theory (and probably several years of in-depth experience), and may require proprietary knowledge to do at all.
$750 for a used Power FC does not sound like a bad deal.
Originally Posted by bureau_c
The 64 pin microcontroller (good luck figuring out exactly what it is....I spent considerable time and effort attempting this, and failed. Of course, feel free to make me feel stupid and if you're successful, pass on the info! The ones I have seen were not marked in any way that told me what they were however) and the 18 pin EPROM are both removed and socketed. A new EPROM is burned and put in the 18-pin socket. The 64-pin controller is NOT replaced, but a daughter board is plugged into the socket from which it came. This daughter board in turn has a pair (one 64 pin, one 18 pin) of sockets and some address decoding logic on it. The controller goes in the big socket, another EPROM goes in the little one. The new external EPROM is burned with data that replaces info that is in the controller's internal ROM...fuel maps, stuff like that. The address decoding logic causes the controller to pull data out of external EPROM rather than internal ROM for particular address ranges.
There would really be no point to rewriting code for this controller even if you did figure out which one it was. It would be nice to know the memory locations of all the maps, etc...then you could perform the Pettit/M2/whatever mod yourself. Someone mentioned creating some kind of emulator to cable over to the ECU controller socket...that would be a huge effort, and again unless you're purely into it for sport, not nearly worth the effort. Better and more elegant solutions already exist.
There would really be no point to rewriting code for this controller even if you did figure out which one it was. It would be nice to know the memory locations of all the maps, etc...then you could perform the Pettit/M2/whatever mod yourself. Someone mentioned creating some kind of emulator to cable over to the ECU controller socket...that would be a huge effort, and again unless you're purely into it for sport, not nearly worth the effort. Better and more elegant solutions already exist.
If you did want to develop a fully reprogrammable ECU, it would be probably be easier to start from scratch with more modern chips (can you say Power FC?). This would probably be 5-10 man-years of work to do properly and would require significant hardware resources (as in several 13Bs that you might blow and lots of expensive monitoring equipment), would require an incredibly deep knowledge of modern engine theory (and probably several years of in-depth experience), and may require proprietary knowledge to do at all.
$750 for a used Power FC does not sound like a bad deal.
Last edited by moconnor; Jan 4, 2005 at 08:49 PM.
Trending Topics
http://www.megasquirt.info/
PowerFC would be for tuners, while MegaSquirt is for programmers, engineers and developers. MS will give you much more control at the expense of less previous experience. I can count on my fingers the number of people I've heard of who are running MegaSquirt on rotary cars, much less turbocharged rotaries. I don't know of a single FD3S that's using MegaSquirt.
For engine control, I'd start with a cheaper and simpler platform, for instance a non-turbo car with the simplest engine possible. The staged fuel injectors and oil injection in the rotary could be quite the obstacle, it's a relatively unique idea; how many piston-engined cars do you know of that use a complicated EFI system like that?
Good luck, I'll buy it if you can get it working with a stock FD3S. It would save me tons of time, because I haven't even attempted it yet.
-s-
PowerFC would be for tuners, while MegaSquirt is for programmers, engineers and developers. MS will give you much more control at the expense of less previous experience. I can count on my fingers the number of people I've heard of who are running MegaSquirt on rotary cars, much less turbocharged rotaries. I don't know of a single FD3S that's using MegaSquirt.
For engine control, I'd start with a cheaper and simpler platform, for instance a non-turbo car with the simplest engine possible. The staged fuel injectors and oil injection in the rotary could be quite the obstacle, it's a relatively unique idea; how many piston-engined cars do you know of that use a complicated EFI system like that?
Good luck, I'll buy it if you can get it working with a stock FD3S. It would save me tons of time, because I haven't even attempted it yet.
-s-
Originally Posted by scotty305
http://www.megasquirt.info/
Good luck, I'll buy it if you can get it working with a stock FD3S. It would save me tons of time, because I haven't even attempted it yet.
Good luck, I'll buy it if you can get it working with a stock FD3S. It would save me tons of time, because I haven't even attempted it yet.
-s-
Junior Member
Joined: Nov 2004
Posts: 19
Likes: 0
From: east
This may have come across many times before, but I've never read anything about it...
How big are the fuel and timing maps? Either a number of cells, or numbers of rows and columns would be nice to know as well. We know the word length is 8 bits wide; it is mentioned time and time again. How about the processor speed? The stock device may have more than enough throughput, and enough resolution for >15 psi, or even slightly more.
How big are the fuel and timing maps? Either a number of cells, or numbers of rows and columns would be nice to know as well. We know the word length is 8 bits wide; it is mentioned time and time again. How about the processor speed? The stock device may have more than enough throughput, and enough resolution for >15 psi, or even slightly more.
Junior Member
Joined: Nov 2004
Posts: 19
Likes: 0
From: east
Originally Posted by SurgeMonster
yea but you cant upgrade the injectors with it
15psi would create some serious power with a well put together fd
15psi would create some serious power with a well put together fd
apex seal BBQ
Joined: Sep 2002
Posts: 867
Likes: 1
From: AL
Originally Posted by scotty305
PowerFC would be for tuners, while MegaSquirt is for programmers, engineers and developers.
We even contemplated doing a MegaSquirt on an FSAE race car, but for the time invested, it was worth it to buy a Motec.
Joined: Mar 2001
Posts: 31,833
Likes: 3,232
From: https://www2.mazda.com/en/100th/
its too bad the with the fd you can just buy a power fc, theres really no point in cracking in the stocker.
www.16paws.com
and do a search for henrik he's got a chip for the s4 t2's
www.16paws.com
and do a search for henrik he's got a chip for the s4 t2's
Originally Posted by PropDue
With what? The tuner shops burned ECUs yes, but if someone can figure out how to change the fuel map values or a fuel modifier it would be like any other burned stock ECU. Some even run 100% larger injectors over stock with no issues.
While you can probably get to the point where you decode the stock ECU, you still have to have something in between the ECU and the rest of the car to make the changes (i.e. what piggybacks like EFI/PMC already do). Since you can't alter the actual stock chip, you have to have something do it in real time before it sends the signals to the components.
By the time you get something to interface with the stock ECU, and create software so you can adjust it, you could have just bought a EFI/PMC or better yet, something like a PowerFC/Haltech.
BTW, from what I understand, the Megasquirt for a rotary is fuel only - no ignition control. Distributor? No thanks. Please correct me if I'm wrong.
I am still SO thankful that Apexi brought out the PowerFC for the FD. It's such an elegant solution, and is so reasonably priced. Can't wait to get one of my own.
Dale
I am still SO thankful that Apexi brought out the PowerFC for the FD. It's such an elegant solution, and is so reasonably priced. Can't wait to get one of my own
.Dale
